ILM

📘 Documentation: Log Retention Policy (ILM)

Purpose: Automatically delete demo-app-logs-* indices once they reach 15 days of age to manage disk space. Log Source: Fluent Bit (sending daily dated indices).

1. The ILM Policy (`demo_app_logs_retention_policy`)

This policy defines the “rules” for the data. Since the logs are already rotated daily by Fluent Bit, we use a simple Delete-only phase.

Hot Phase: Active; no actions (keeps logs searchable).
Delete Phase: Triggers when the index age is > 15 days.

PUT _ilm/policy/demo_app_logs_retention_policy
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {}
      },
      "delete": {
        "min_age": "15d",
        "actions": {
          "delete": {
            "delete_searchable_snapshot": false
          }
        }
      }
    }
  }
}

2. The Index Template (`demo_app_logs_template`)

This is the “glue” that ensures every new index created by Fluent Bit automatically follows the retention policy.

Index Pattern: demo-app-logs-*
Settings: Links the index to the policy name.

PUT _index_template/demo_app_logs_template
{
  "index_patterns": ["demo-app-logs-*"],
  "template": {
    "settings": {
      "index.lifecycle.name": "demo_app_logs_retention_policy"
    }
  }
}

3. Application to Existing Indices

New policies only apply to indices created after the template is made. To manage existing “unmanaged” indices, the policy must be attached manually:

PUT demo-app-logs-*/_settings
{
  "index": {
    "lifecycle.name": "demo_app_logs_retention_policy"
  }
}

🛠 Troubleshooting & Maintenance

How to check status

To see if the “Janitor” (ILM) is currently processing or deleting indices:

GET demo-app-logs-*/_ilm/explain

Common States

Step	Meaning
`hot`	The index is younger than 15 days; it is safe and searchable.
`delete`	The index has hit 15 days; it has entered the deletion queue.
`wait-for-shard-history-leases`	The final safety check before the files are wiped from the disk.

Key Takeaways for Future Ref

No Rollover: Do not use rollover in the policy if your logs already have dates in their names (e.g., logs-2026.03.05). Using both causes alias errors.
No Aliases: In this simplified setup, aliases are not required, making the system much harder to break.
10-Minute Poll: ILM checks for deletions every 10 minutes by default. Changes are not always instant.

EFK Stack

DataDog

Grafana Stack

Jaeger

Loki Stack

OpenSearch

📘 Documentation: Log Retention Policy (ILM)

1. The ILM Policy (`demo_app_logs_retention_policy`)

2. The Index Template (`demo_app_logs_template`)

3. Application to Existing Indices

🛠 Troubleshooting & Maintenance

How to check status

Common States

Key Takeaways for Future Ref

​📘 Documentation: Log Retention Policy (ILM)

​1. The ILM Policy (demo_app_logs_retention_policy)

​2. The Index Template (demo_app_logs_template)

​3. Application to Existing Indices

​🛠 Troubleshooting & Maintenance

​How to check status

​Common States

​Key Takeaways for Future Ref

📘 Documentation: Log Retention Policy (ILM)

1. The ILM Policy (`demo_app_logs_retention_policy`)

2. The Index Template (`demo_app_logs_template`)

3. Application to Existing Indices

🛠 Troubleshooting & Maintenance

How to check status

Common States

Key Takeaways for Future Ref